I have different Fields values like - teamNameTOC, teamNameEngine under same field Name(teamName) want to merge these two values in single report.
I have tried below and output also attached
teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
OUTPUT
teamName count percent
TOC 233 50.000000
Engine 84 18.025751
DA 66 14.163090
SE 55 11.802575
DBA 28
I need all above values Count (team name , count , %) in one row as single entity. % should adjust itself if add new more values.
Output should look like -
teamName count percent
All Teams 466 100.00
You should be able to do that with the append command.
teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
It's not clear what the final result should be. If you want a total row in addition to the existing results then try this search:
teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| addcoltotals labelfield=teamName label="All Teams"
HI. Thank you for reply.
Solution you given resulted same as mine mentioned commands.
I need "All Teams"'s count ONLY the output and want to rename "All teams" as a "IA".
Try this:
teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| table teamName, count, percent
Thank you so much ! Its worked good.
Kindly let me know, how can I add one more row of another fields to get result as below-
I have field values for "IB" and need to add row below the result of"IA".
Fileds Values -
teamName=A OR teamName=B OR teamName=C OR teamName=D OR teamName=E | top limit=50 teamName
RoutingKey Count Percentage
IA 250 100.00
IB count %
You should be able to do that with the append command.
teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
Thank you so much ! It worked.
Hi Rich
Solution you given worked perfectly, but its parsing my output and getting time for result.
Also, I need average of all results , but it do sum of all avg in Totals. Plz advise.